Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 26 Apr 2018 12:11:06 -0400
From: Marshall Schor <schor@...che.org>
To: oss-security@...ts.openwall.com
Subject: [ANNOUNCE] CVE-2017-15691: Apache UIMA XML external entity expansion
 (XXE) attack exposure

CVE-2017-15691: Apache UIMA XML external entity expansion (XXE) attack exposure

Severity: Important  

Vendor:
The Apache Software Foundation

Versions Affected:
  - uimaj 2.x.x releases prior to 2.10.2
  - uimaj 3.0.0 releases prior to 3.0.0-beta
  - uima-as releases prior to 2.10.2
  - uimaFIT releases prior to 2.4.0
  - uimaDUCC releases prior to 2.2.2

Description.
The details of this vulnerability were reported to the Apache UIMA Private
mailing list.

This  vulnerability relates to an XML external entity expansion (XXE) capability
of various XML parsers. See
   https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
for more details.

UIMA as part of its configuration and operation may read XML from various
sources, which could be tainted in ways to cause inadvertent disclosure of local
files or other internal content.

Mitigation:
Users are advised to upgrade these UIMA components to the following levels or later:
  - uimaj: 2.x.x upgrade to 2.10.2 or later
  - uimaj: 3.x.x upgrade to 3.0.0 or later
  - uima-as: upgrade to 2.10.2 or later
  - uimaFIT: upgrade to 2.4.0 or later
  - uimaDUCC: upgrade to 2.2.2 or later

Credit: Joern Kottmann

-Marshall Schor, on behalf of the UIMA Project Management Committee 


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.